While accuracy is an apparent measure of prediction, robustness is another desired feature. A model that can produce high prediction accuracy but acts violently to small perturbations on input has limited use in practice. A better model should be robust under adversarial attacks [1]}. The demand of robustness is more pronounced during critical conditions such as the pandemic [2]}, [3]} and the deep learning era: while deep learning models can deliver state of the art performance, they are known to be fragile to adversarial examples—small crafted perturbations to the input can lead to highly unpredictable behaviors of the model [4]}. As an example, a state of the art deep learning model can mis-classify a stop sign as a 45 mph speed limit sign with minor changes to the sign [5]}. These types of attacks have serious safety implications for vehicles equipped with such a technology, e.g., autonomous driving.
